CVE-2025-13742: Limited HTML injection in emails
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13742?
CVE-2025-13742 has a moderate severity rating as it involves HTML or Markdown injections in email templates.
How does CVE-2025-13742 exploit customer data?
CVE-2025-13742 exploits customer data by allowing HTML or Markdown formatting in attendee names, potentially leading to injection attacks.
How can I mitigate CVE-2025-13742?
You can mitigate CVE-2025-13742 by sanitizing user input to strip away any HTML or Markdown formatting before using it in email templates.
Which versions of pretix are affected by CVE-2025-13742?
CVE-2025-13742 affects all versions of pretix prior to the security update addressing this vulnerability.
What should I do if I am impacted by CVE-2025-13742?
If impacted by CVE-2025-13742, you should update to the latest stable version of pretix as soon as possible to eliminate the vulnerability.